uVote Privacy Policy

This policy describes the information used by the current uVote app, who can access it, and what happens when you leave a room, restart an election, or delete an account.

Account and Verification Information

uVote uses your account ID, full name, email address, creation date, and optional profile-photo link. Firebase Authentication handles passwords and sign-in credentials. Manual registration uses email and password without an app email-verification step. Google sign-in supplies an authenticated identity, email, and, where available, name and photo link to create your profile. Linking Google to an existing account preserves its Firebase account ID and voting records. The app does not receive your Google password. Firebase Authentication sends password-reset emails for password accounts. uVote no longer sends verification emails through EmailJS; Google may perform its own security checks.

Device and Local App Information

The app hashes Android ID on Android or identifierForVendor on iOS; other supported environments use a locally generated installation identifier. A database record links the hash to one account ID. Registration, both login methods, and restored sessions check this binding. Signing out or deleting an account does not release it for another account. This is a device-related identifier, not anonymous data or proof of identity, and some device changes can reset it. Visual-effects preferences and, where used, an installation identifier are stored locally. Authentication services may retain sign-in state and app services may cache data on the device.

Voting Room and Candidate Information

Room records include the room name, owner ID and name, pool name, access mode, optional schedule and banner, position settings, seat limits, and aggregate election totals. Candidate records include names, photos, positions, party lists, platforms, and vote counts. Membership records include account ID, name, optional photo link, joining date, owner status, voting status, and receipt ID when applicable. Profile changes may be copied into related room and code-request records.

Access Codes, Requests, and Notifications

Code records include the code, its status, creation date, and the redeemer’s account ID, name, and redemption time. Code requests include your account ID, name, request status and dates, and any assigned code or decline reason. uVote does not collect payment information. Rooms and requests created by older versions may still contain a GCash number, account name, or payment reference entered at that time; the app no longer collects or shows them. In-app notifications tell owners about new requests and tell requesters when a request is approved or declined, and they retain read status.

What Is Recorded When You Vote

Your selections are used to update candidate totals. The current ballot submission does not save a list of your selected candidates alongside your account in the election database. It does keep your account ID, voting time, and transaction ID in a participation record, plus your membership’s voting status. These records prevent another ballot in the same round after leaving and rejoining. This design does not guarantee complete anonymity, particularly in small elections or where observers compare changing totals.

Why Information Is Used

Account credentials and Google identity support registration, sign-in, recovery, and account linking. Device bindings reduce repeated account creation on a device; they do not block existing accounts from signing in on another device. Room, membership, and code data support joining, rejoining, owner administration, and request review. Election data support ballot submission, duplicate-vote checks, receipts, and results. Photos and profile information personalize the app and identify candidates or members. Notifications communicate request activity. This version does not include advertising or an analytics feature.

Who Can Access Information

The room owner can view their room’s members and voting status, access codes, and code requests. The app does not provide an owner screen showing each member’s candidate choices. Signed-in accounts can read room and candidate records, including aggregate totals and any legacy payment details from older versions, even where the interface limits what is displayed. A signed-in account that knows a code can retrieve its record, including redemption details. Uploaded image links can be viewed by people who obtain them. Do not treat room names, codes, images, or hidden result screens as private storage.

Connected Services and Protection

Firebase Authentication and Cloud Firestore provide account and database services. Google provides optional Google sign-in. Cloudinary stores uploaded profile photos, candidate photos, and pool banners. Google profile photos may also be loaded from Google-hosted links. These providers process information needed for their services and may process connection information under their own policies. uVote no longer uses EmailJS for registration. Sign-in and database rules protect parts of the app, but some room records have broad access. Device checks are not hardware attestation. No absolute security or confidentiality guarantee is made.

Leaving, Resets, and Retention

Leaving removes current room membership and the room from your joined list. It does not erase the used-code record or previous participation record, so the same account can reuse its code without voting twice. Approved or rejected requests may be replaced when you start a fresh request after leaving. Ending voting retains election data. Restarting clears participation and vote totals; replacing a pool also clears candidates. Room deletion removes its candidates, memberships, participation records, codes, and requests. This version has no automatic retention schedule covering all remaining records.

What Account Deletion Does

Use Settings → Delete Account. Confirm with your password, or through Google if the account has no password. The app deletes the sign-in account and profile, deletes a room you own, and attempts to remove memberships, notifications, and some related requests. The hashed device binding and account ID remain reserved to prevent using deletion to register again and cast another ballot. There is no automatic expiry for this binding; contact the app administrator for recovery or a privacy request. Votes counted in other owners’ rooms and participation records remain until those rooms are reset or deleted. Used-code records, requests in rooms previously left or never joined, and historical verification records from older app versions may remain. Uploaded Cloudinary images are not automatically deleted by this action.

Your Choices and Privacy Requests

You can edit your name and photo, change a password account’s password, link Google to your signed-in account, leave joined rooms, cancel code requests, delete notifications, or delete your account. Google-only users manage their Google password through Google. Email editing is currently disabled. Under applicable Philippine data-protection law, rights may include information, access, correction, objection, erasure or blocking, and portability, subject to legal conditions. Contact the developer using About App for requests the screens do not support, including retained device bindings and historical verification data, and the room owner for records they manage. You may raise privacy concerns with the National Privacy Commission. Guidance: https://privacy.gov.ph/data-subject-rights/

Updates and Contact

The date above identifies this policy version. For questions about a specific room, contact the room owner through your organization’s usual channel. For app-wide data concerns, use the developer contact displayed in About App. This version has no in-app privacy-request form. Changes to app features or service providers may require an updated policy.